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In this study, we developed a document for managing Information 
Technology suppliers in hospitals. This document is used to ensure the 
proper management of IT suppliers in the hospital. Products and services in 
Information Technology have characteristics and specifications that are 
always up to date, making it difficult for non-IT people to understand. 
Hospitals whose main business in the health sector is often lack of human 
resources who understand IT. Observations and interviews were conducted in 
Indonesian hospital, to identify the characteristics and problems in supplier 
management. Control Objectives for Information and Related Technologies 
(COBIT), Information Technology Infrastructure Library (ITIL) and 
government regulations on supplier management were reviewed and 
combined as a benchmark and guidance on how supplier management 
activities are carried out. The result of the process is a Standard Operating 
Procedure (SOP) document. The parties involved in the supplier management 
process have evaluated the SOP document. From the results of the study, it is 
known that currently, the hospital is still focused on procedures procurement 
of goods and services that are government regulated. This study proposes 
some new activities that are not currently done by the hospital. 

Copyright © 2018 Institute of Advanced Engineering and Science. 

All rights reserved. 


Corresponding Author: 

Indra Kharisma Raharjana, 

Department of Information Systems, Faculty of Science and Technology, Universitas Airlangga, 
Kampus C UNAIR Mulyorejo, Surabaya, Indonesia 
Email: indra.kharisma@fst.unair.ac.id 


1. INTRODUCTION 

Although many studies have suggested that Information Technology (IT) can improve the quality of 
service and competitiveness [l]-[4], the applications of IT in hospitals are still lacking [5], [6]. The 
government encourages hospitals to leverage IT to support health services [7]. Although the IT 
implementation in hospitals is low, hospitals IT spending is increasing [8]. This is a challenge for hospitals to 
procure IT goods/services and manage suppliers. IT goods and services have special characteristics, but the 
majority of hospitals do not have adequate human resources [7]. This is an opportunities to introduce 
management of IT suppliers to hospitals. So that supplier management processes can put a priority on 
customer service. 

Several studies related to organizational governance have been conducted, both for public 
organizations [9]-[14] and for health organizations [15], [16]. There are several frameworks and standar 
commonly used to help organizations implement IT such as Control Objectives for Information and Related 
Technologies (COBIT), Information Technology Infrastructure Library (ITIL), and International 
Organization for Standardization (ISO). COBIT that emphasizes governance [17], ITIL that help 
organizations create recipes to run excellent services [18], and ISO provides products, services and systems 
specifications to ensure quality, safety and efficiency [19]. In this paper, we will only focus on using the 
COBIT and ITIL framework rather than using ISO standard, this is because we want to use practices that are 
generally employed [20]. We propose to use ITIL and COBIT to assist hospitals to develop standard 
operational procedures related to supplier management. This will facilitate the hospital in managing the 
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supplier, from the procurement process, contracting, service operations, supplier evaluation, contract 
termination, to continuous improvement in supplier management. Suppliers in the hospital need to be well 
managed because it will affect the services to the public. 

We will combine supplier management standards from ITIL and COBIT for hospital practice. 
Identify activities that have been done by the hospital to manage the supplier. Apply these standards to 
activities that are usually performed in hospitals.The purpose of this study is to establish working procedures 
to assist hospitals to manage suppliers in information technology. This document is important for the hospital 
in order to uphold the process for managing supplier. This minimizes the risks of service disruptions caused 
by contracts with suppliers.In this study, we conducted a case study at a government hospital located in 
Surabaya, Indonesia. We explore patterns based on activities undertaken at the hospital, to then integrate 
them with COBIT and ITIL standards regarding supplier management. We also consider government 
regulations related to procurement of goods/services. 


2. RESEARCH METHOD 

In this paper, we use the principle of design science research by creating an artifact to answer 
research questions [21]. Supplier management guide document is created to help the hospital to manage 
relationships with suppliers. To prepare the supplier management guide document, the steps taken are as 
follows: conducting observations and interviews in hospitals. Managing Suppliers based on IT Standars, 
Proccess Mapping, Preparation of New Procedures, and Evaluation of New Procedures. In this study, we 
conducted an observation, interview, and evaluation in one of the government hospitals located in Surabaya, 
Indonesia. 

Interviews were conducted in a semi-structured manner [22]. We asked and observed how the 
contract management with suppliers is implemented, we use best practice from COBIT and ITIL as the 
checklist of questions, how is the process done, ask if there have been any rules governing supplier 
management issues within the hospital. 

Conducting literature studies related to the management of suppliers such as COBIT, ITIL, and 
government regulations. Initially, we plan to only use Process Practice and Activity for Manage Supplier 
from COBIT5 and Activity of ITIL Supplier Management. But in practice, hospitals emphasize that the 
management of suppliers, especially on contractual issues must follow established rules and regulations 
Therefore we have to include government regulations on the procurement of goods and services as the basis 
for supplier management guide document. 

Mapping, compiling, and incorporating COBIT, ITIL, and government regulations are appropriate 
to the conditions and characteristics of the organization. We will evaluate the processes and activities of 
managing suppliers available in COBIT, ITIL and Government regulations. Each activity will be analyzed 
and grouped according to their similarity. It will be rearranged into new procedures documents. 

The evaluation is conducted through meetings with the involved parties, such as the head of IT 
team, the head of the Budget Program Planning, and the staff of the Procurement Services Unit. Evaluation is 
done to find out the shortcomings and weaknesses of documents that have been prepared, in order to make 
improvements. 


3. RESULTS 

3.1. Observation and Interviews Results 

The results of interviews and observations are as follows. Hospitals have no formal guidance for 
contract management for suppliers. Hospital relationships with suppliers are currently regulated in 
government regulations on the procurement of goods and services [23]. That regulation contains the detailed 
procedures for procurement of goods and services. There is a discussion of contract rules, but it does not fully 
cover what should be in the supplier contract. Lor IT contracts in hospitals, this exposes business risk. IT has 
an important impact on hospital services. However, hospitals do not have enough resources to effectively 
manage IT. Defining contract details becomes critical to avoid conflict. Some contract-related cases have 
occurred in hospitals, resulting in losses from both parties. A common obstacle is the lack of IT technical 
knowledge of the personnel responsible for contract management. Hospitals need to ensure that contract 
management with suppliers has passed the correct procedures. Hospitals need to ensure that contract 
management with suppliers has passed the correct procedures, including considering the contents of the 
contract.Hospitals have many IT services that need to be managed. This consists of three aspects: network, 
server, and software. Hospitals work with different external suppliers from initial assessment process to 
system installation. 
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3.2. Managing Suppliers based on IT Standars 

In this study, we use COBIT5 and ITIL standards to identify best practices in supplier management. 
COBIT5 defines the best practice of supplier management in APO 10 manage supplier process.this process 
recommends 5 Key Management Practices (KMP) in supplier management. This KMP includes [17]: identify 
and evaluate supplier relationships and contracts, select supplier, manage supplier relationships and contracts, 
manage supplier risk, and monitor supplier performance and compliance. There are several activities that 
need to be done within each KMP. This activity proposes on what to do, not how to do. We use the ITIL 
framework to describe how to do. COBIT5 Procces Practice and Activity for Manage Supplier depicted in 
Table 1. 


Table 1. COBIT5 Procces Practice and Activity for Manage Supplier [17] 


Key Management Activity 

Practice Code 


Activities 


Identify and evaluate 
supplier relationships and 
contracts 


Select suppliers 


Manage supplier 
relationships and 
contracts 


Manage supplier risk 


Monitor supplier 
performance and 
compliance 


APOlO.01-1 

APOlO.01-2 

APOlO.01-3 

APOlO.01-4 

APO 10.02-1 
APO 10.02-2 
APO 10.02-3 

APO 10.02-4 
APO 10.02-5 
APO 10.02-6 
APO 10.02-7 

APO 10.03-1 

APO 10.03-2 
APO 10.03-3 

APO 10.03-4 

APO 10.03-5 

APO 10.03-6 

APO 10.03-7 
APOlO.03-8 

APO 10.04-1 
APO 10.04-2 
APO 10.05-1 
APO 10.05-2 

APO 10.05-3 
APO 10.05-4 
APO 10.05-5 
APO 10.05-6 


Establish and maintain criteria relating to suppliers and supplier contracts. 

Establish and maintain supplier and contract evaluation criteria 
Identify, record and categorise existing suppliers and contracts 
Periodically evaluate and compare the performance of existing and alternative 
suppliers 

Review all Supplier requests for information (RFI) and requests for proposals (RFP) 

Evaluate RFIs and RFPs 

Select the supplier that best fits the RFP 

In the specific case of software acquisition, include and enforce the rights and 
obligations of all parties in the contractual terms. 

In the specific case of acquisition of development resources, include and enforce the 
rights and obligations of all parties in the contractual terms. 

Obtain legal advice on resource development acquisition agreements regarding 
ownership and licencing of intellectual property 

In the specific case of acquisition of infrastructure, facilities and related services, 
include and enforce the rights and obligations of all parties in the contractual terms 
Assign relationship owners for all suppliers and make them accountable for the quality 
of service(s) provided. 

Specify a formal communication and review process 

Agree on, manage, maintain and renew formal contracts with the supplier. 

Within contracts with key service suppliers include provisions for the review of 
supplier site 

Evaluate the effectiveness of the relationship and identify necessary improvements 
Define, communicate and agree on ways to implement required improvements to the 
relationship. 

Use established procedures to deal with contract disputes 

Define and formalise roles and responsibilities for each service supplier 

Manage risk relating to the supplier's ablility to deliver service efficiently, effectively, 

securely, reliably, and continually 

When defining the contract, provide for potential service risk by clearly defining 
service requirements 

Define and document criteria to monitor supplier performance aligned with service 
level agreements 

Monitor and review service delivery to ensure that the supplier is providing an 
acceptable quality of service 

Review supplier performance and value for money to ensure that they are reliable and 
competitive 

Request independent reviews of supplier internal practices and controls, if necessary. 
Record and assess review results periodically and discuss them with the supplier to 
identify needs and opportunities for improvement. 

Monitor and evaluate externally available information about the supplier. 


ITIL described Supplier Management in the service design phase. Supplier Management is the 
process of ensuring all contracts with suppliers meet the organization's business needs, ensuring all suppliers 
meet their contract commitments, review contracts, and maintain relationships with suppliers.the activity of 
supplier management can be summarize in [18]: (a) definition of new supplier and contract requirement, (b) 
evaluation of new supplier and contracts, (c) supplier and contract categorization and maintenance, (d) 
estasblisment of new supplier and contracts, (e) supplier, contract, and performance management, (f) contract 
renewal or termination. Activity of ITIL supplier management is depicted in Table 2. 

We also consider government regulations (PP No. 54 th. 2010) on the procurement of goods and 
services [23] to ensure compliance with regulations. The regulation governs the procurement preparation 
process, selection planning for goods/services providers, controlling, monitoring, complaints, and sanctions. 
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Table 2. Activity of ITIL Supplier Management [18] 


Activity 

Definition of new supplier and contract 
requirements 


Evaluation of new suppliers and contracts 


Supplier and contract categorization and 
maintenance of the SCMIS 


Establishment of new supplier and contracts 


Supplier, contract, and performance management 


contract renewal or termination 


Code 

SMOl-1 

SMOl-2 

SMOl-3 

SM02-1 

SM02-2 

SM02-3 

SM02-4 

SM02-5 

SM02-6 

SM03-1 

SM03-2 

SM03-3 

SM03-4 

SM03-5 

SM04-1 

SM04-2 

SM04-3 

SM05-1 

SM05-2 

SM05-3 

SM05-4 

SM05-5 

SM05-6 

SM06-1 

SM06-2 

SM06-3 


Sub-Activity 

Identify Business need 

Produce a statement of requirement (soR) and invitation to tender (ITT) 

Ensure conformance to strategy/policy 

identify method of purchase or procurement 

establish evaluation criteria 

evaluate altrnative options 

Select 

Negotiate contracts,targets, and the terms and conditions. 

agree and award the contract 

Assess or reassess the supplier and contract 

ensure changes progressed through service transition 

categoriza the supplier 

update SCMIS 

ongoing maintenance of the SCMIS 
Set up the supplier service and contract 
transition the service 
establish contracts and relationships 

manage and control the operation and delivery of service/products 
monitor and report 
review and improve 

manage the supplier and the relationship 
review service scope against business need 
plan for possible closure/renewal/extension 
Review 

renegotiate and renew or terminate and/or transfer 
transition to new supplier or to internal resources 


3.3. Proccess Mapping 

We combine processes and activities within ITIL, COBIT, and Government Regulations. We use 
ITIL activity as a combination baseline. The result of activity mapping can be seen in Table 3. 


Table 3. Procces and Activity Mapping 


Aktivitas Supplier Management 

ITIL 

COBIT 5 

PP No. 54 Th 2010 


SMOl-1 

APO 10.02-1 

BAB VI Bag. 6 Ps. 64 

Definition of new supplier and contract 

SMOl-2 

APOlO.02-2 

BAB VI Bag. 10 Ps. 79 

requirements 

SMOl-3 

- 

BAB IV Ps. 22 


SMOl-4 

SM02-1 

- 

BAB VI Bag. 3 Par. I Ps. 35 


SM02-2 

APOlO.01-2 

BAB VI Bag. 3 Par. 4 Ps. 48 


SM02-3 

APOlO.04-1 

APOlO.04-2 

- 


SM02-4 

APOlO.01-4 

- 

Evaluation of new suppliers and contracts 

SM02-5 

APOlO.02-3 

BAB VI Bag. 10 Par. 6 Ps. 79 

BAB VI BAG. 10 Par. 7 Ps. 80 



APO 10.02-4 
APOlO.02-5 



SM02-6 

APOlO.02-6 

APO 10.02-7 
APOlO.03-4 
APOlO.03-8 

- 


SM02-7 

APOlO.03-3 

BAB VI Bag. 10 Par. 11 


SM03-1 

SM03-2 

APOlO.04-2 

- 

Establishment of new supplier and 
contracts 

SM03-3 

APOlO.02-3 

APOlO.05-1 

APOlO.05-5 

- 


SM03-4 

APOlO.03-1 

APOlO.03-3 

- 


SM04-1 

- 

- 

Supplier and contract categorization and 

SM04-2 

APOlO.01-1 


maintenance of the SCMIS 

APOlO.01-3 



SM04-3 

SM04-4 

SM05-1 

APOlO.05-1 

APOlO.05-2 

APOlO.05-3 

- 


SM05-2 

APOlO.05-4 

BAB XV Bag. 2Ps. 116 

Supplier, contract, and performance 
management 

SM05-3 

APOlO.05-5 

APOlO.05-6 

BAB XV Bag. 1 Ps. 115 


SM05-4 

APOlO.03-7 

BAB XV Bag. 1 Ps. 115 


SM05-5 

APOlO.05-2 

APOlO.05-3 

- 


SM05-6 

APOlO.03-2 

BAB VI Bag. IlPar. 7Ps. 94 

contract renewal or termination 

SM06-1 

SM06-2 

APOlO.05-3 

APOlO.05-5 

BAB VI Bag. IlPar. 6 Ps. 93 

BAB VI Bag. IlPar. 6 Ps. 93 
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3.4. Preparation of New Procedures 

The new procedure is prepared based on the mapping of activities and processes from COBIT, ITIL, 
and government regulations, we made some adjustments in the preparation of the document. Some activities 
are changed, omitted, or combined. We defined there are 6 main processes of suppliers management in the 
hospital (Table 4), namely: identify business needs and business case preparation, procurement and 
evaluation of new suppliers contracts, initiation of new contract, categorization of supplier and contract, 
supplier and contract performance management, and contract renewal or termination. Standard Operating 
Procedure (SOP) document is then prepared based on identified processes and activities. We use the SOP 
format that has been used by the hospital. 


Table 4. Activity of New Procedures 


No. Work steps 

Related unit 

Activity for Identify business needs and business case preparation Procedure 



j Identify the purchase / procurement method, arrange supplier selection method, and Set supplier selection 
method 

2 Arrange procurement documents. Review the procurement document. 

Prepare the initial business case, including options (internal and external), cost, time range, target, profit 

3 and risk assessment etc. Communicate the initial business case to the IT / IT division, and make sure that 
business and IT parties approve the initial business case. 

Activity for Procurement and Evaluation of New Suppliers Contracts Procedure 

Arrange the evaluation criteria of the procurement document that contains the supplier-related 
considerations (services, capabilities (both personnel and organization), quality and costs, etc.), Accept 
^ the procurement document criteria that have been prepared. Evaluate procurement documents according 
to predefined evaluation process / criteria and make sure they are in line with applicable business policies 
/ policies. Maintain documentary evidence from the evaluation, and Verify references from potential 
vendors 

Evaluate the impact of suppliers / contracts and their potential risks to avoid errors that could result in 
losses (financial risks, business reputation, operations, regulators, laws). Plan how to address potential 

2 service risks by clearly defining service requirements, including software deed agreements, alternative 
suppliers, or standby agreements to mitigate possible supplier errors, intellectual property protection and 
security and legal and regulatory requirements. Compare the performance of suppliers and alternative 
suppliers. And Create an overall review. 

Select suppliers and contracts that best match the results of the procurement document evaluation, 

3 Document the decision. Communicate the decision, In any supplier relationship, establish the relationship 
owner for all suppliers responsible for the quality of service provided 

Negotiate contracts, targets and terms and conditions (including liability, closure, renewal, extension, 
dispute, transfer). Use and launch roles and responsibilities for each service supplier. When multiple 

4 suppliers work together to provide a service, consider allocating the main contractor role to one of the 
suppliers to be responsible for the contract as a whole. Get legal advice on approval of resource 
acquisitions related to ownership and licensing of intellectual property 

5 Approve the Contract 


Procurement Unit 
Commitment Maker 
Official 

Procurement Unit 
IT Unit 


Procurement Unit 


IT Unit 

Budget Program 
Planning 


Procurement Unit 
IT Unit 

Budget Program 
Planning 

Procurement Unit 
IT Unit 


Activity for Initiation of New Contract Procedure 

^ Supplier and contract service configuration and their information in the SCD (Supplier and Contract 
Database) and other enterprise systems. 

2 If the contract / project is the replacement of the old system, you should take and note the transition 
process so that the productivity of the system is not compromised. 

Activity for Categorization of Supplier and Contract Procedure 


IT Unit 
IT Unit 


Create and maintain criteria based on type, significance and criticality of suppliers and supplier contracts, 

1 Document these criteria. Categorize suppliers, then determine how important the supplier is to the service IT Unit 
providers and services provided by the business. Focus on the most important and priority suppliers. 


2 Update SCD every change related to supplier and/or contract. Perform SCD maintenance 


IT Unit 


Activity for Supplier and Contract Performance Management Procedure 

j Define criteria to supervise supplier performance in accordance with the applicable agreement. 
Document these criteria. 

2 Monitor and Reporting 

^ Review on a regular basis. Record and review the results periodically. Discuss with suppliers to identify 
needs and opportunities for improvement, and Implement planned improvements. 

Perform supplier and relationship management (formal / non-formal communication, risk, change, 

^ failure, repair, contact, and interface). Use established procedures to handle contract disputes, first if 

possible, use effective relationships and communications to address service issues, and Plan for possible 
extensions / updates / extensions. 

Activity for Contract Renewal or Termination Procedure 

If the contract is a Unit Price Contract and there is a possibility of extension, then Review, Record and 
1 value the results of the review, and Re-negotiate the results of the review and discuss with the supplier to 
identify needs and opportunities for improvement, renewal, or termination and / or transfer. 


IT Unit 
IT Unit 
IT Unit 

IT Unit 


IT Unit 


3.5. Evaluation 
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Evaluation is conducted to find out whether the SOP document of contract management has been 
well prepared and easy to understand. The evaluation also sees compatibility with field conditions in 
hospitals. The evaluation was done by reviewing the document using walkthrough method. A walkthrough is 
a type of document review which led by the author of the document and attended by peer groups [23]. The 
walkthrough held at the hospital on October 14, 2016. The walkthrough review was conducted by the head of 
IT team, head of the Budget Program Planning, and staff of the Procurement Services Unit, it aims to get a 
direct response from the person in charge of the activity in the SOP document of contract management. 
Comments and corrections to documents obtained in the review process. 

During an evaluation, a sequence of unfavorable work steps was found in the business identification 
and business case preparation activities. Improvements are made based on input from peer group based on 
experience and regulation. It’s also found some unfamiliar terms such as business case, system transition, and 
SCMIS (Supplier and Contract Management Information System). Some of those activities names and terms 
need to be adjusted. The person responsible for each activity is checked and adjusted. 

SOP document improvements are made to correct the deficiencies and errors found at the evaluation 
stage. Improvement of SOP document of supplier management including: Improvement of terms, sentence 
arrangement and word selection in SOP documents. Role and responsibilities mistakes were fixed, and 
improvement the sequence of activities steps. Peer group states that some processes are helpful in managing 
supplier’s contracts because they are very specific to IT issues, such as software, infrastructure, and 
development resources. 


4. DISCUSSION 

Based on observations and interviews, the hospital does not have standard procedures for managing 
IT suppliers. Procurement process of goods and services are still the main focus for the hospital in managing 
IT supplier. This is because the procurement procedure of goods and services has been regulated by the 
government; it makes the hospital prioritize to follow the regulation. The hospital is still done intuitively and 
unstructured procedure to manage supplier, except for the procurement process. 

The results of activity mapping using COBIT and ITIL indicate that the following activities of 
suppliers management should be performed: identify business needs and business case preparation, 
procurement and evaluation of new suppliers contracts, initiation of new contract, categorization of supplier 
and contract procedure, supplier and contract performance management, and contract renewal or termination. 
The majority of those activities have not been systematically conducted by hospitals. All those activities are 
formalized into SOP documents for IT supplier management. 

The IT supplier management SOP document is recognized to be very helpful to ensure technical 
specifications and quality of goods/services in the field of IT (software, infrastructure, development 
resources). This document provides discourse to the relevant parties regarding supplier management based on 
international standards. However, this work procedure can not be fully applied in the hospital yet. This is due 
to some limitations of rules and authority in applying new procedures. 

Implementation of SOP documents within organizations is problematic and often requires great 
effort; the complexity will increase according to the size of the organization. It takes willpower from top 
management to implement those changes [25]. In this study, we do not discuss the documents application 
into organization operation. Our scope of research is to create SOP documents to manage suppliers according 
to COBIT and ITIL standards. In its application, it is still necessary to adjust to the current conditions and 
need to consider some elements of IT success factors in organizations such as people, work processes, data, 
networks, and software. The toughest challenge of implementing The IT supplier management SOP 
document is the hospital's characteristics of implementing IT in its organization. As in research [26] [27], the 
adoption of technology in healthcare organizations is bound to encounter obstacles such as organizational 
structures and legal restraints. Government hospitals tend to wait for regulations to implement a policy, not 
because of the need for competitive advantage [5]. This paper provides a perspective from the point of view 
of IT management in managing suppliers.there are several papers discussing supplier management from a 
technical point of view, for example [28] using integrated fuzzy MCDM to select and evaluate suppliers, 
selecting coal-fired supplier[29], and optimization of enterprise alliance in supply chain[30]. 

There are possibilities and opportunities to make the document into community practice. By making 
this document open to the community, readable by stakeholders at the hospital, and receiving advice on 
improvement based on hospital experience. In this way, knowledge of the IT suppliers’ management can be 
understood by interested parties. 

In general, the processes of procurement of goods and management of suppliers in hospitals have 
many in common. We believe that the document of supplier management procedures can be a model of 
supplier management in Indonesian hospitals. The application of information technology in Indonesian 
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hospitals has poor reception, less than 5 % have adopted the Hospital Information System [5]. The 
government's impetus regarding the application of IT into the hospital will have an impact on the need for 
infrastructure preparation. It requires quality improvement in the procurement process of goods / services and 
supplier management. 


5. CONCLUSION 

Supplier management guide document was produced for the hospital. This document was derived 
from the merger of activities on supplier management (COBIT, ITIL, and Government Regulations on the 
procurement of goods and services). The limitation of this study is that the guidance document is still a 
model, based on case studies at a government hospital. Other than that this document can only be applied in 
Indonesia because it uses government regulation as a source of document-making. But we believe that our 
model is ready to be applied in other hospitals with little adjustment. In the process of making it, we have 
considered the general pattern of supplier management and government regulations regarding the 
procurement of goods and services. There is an opportunity to make this procedure document a community 
practice for managing IT suppliers in hospitals. By combining best practices in COBIT, ITIL, and 
government regulations, this document is useful for those who handle suppliers, especially IT. 
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